bofh/ansible-fet
9
0
Fork 0
Code Issues 9 Pull Requests Releases Wiki Activity

Activate iptables for all except old qemu

Browse Source
This commit is contained in:
Daniel A. Maierhofer
2018-11-04 21:23:40 +01:00
parent 4b48b83ce9
commit 59b79dadc4
11 changed files with 25 additions and 43 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
host_vars/ariane
View File

@@ -5,7 +5,6 @@ inventory_hostname_short: ariane
common_interfaces: True common_interfaces: True
common_interfaces_file: interfaces_ariane.j2 common_interfaces_file: interfaces_ariane.j2
common_iptables_v4: "iptables_ariane_v4.j2" common_iptables_v4: "iptables_ariane_v4.j2"
common_iptables_v6: "iptables_ariane_v6.j2"
lxc: lxc:
containers: containers:

1
host_vars/progress
View File

@@ -2,5 +2,4 @@ inventory_hostname: progress.fet.htu.tuwien.ac.at
inventory_hostname_short: progress inventory_hostname_short: progress
common_iptables_v4: "iptables_progress_v4.j2" common_iptables_v4: "iptables_progress_v4.j2"
common_iptables_v6: "iptables_progress_v6.j2"
printer_ip: dell3465 printer_ip: dell3465

2
host_vars/proteus
View File

@@ -1,2 +1,4 @@
inventory_hostname: proteus.fet.htu.tuwien.ac.at inventory_hostname: proteus.fet.htu.tuwien.ac.at
inventory_hostname_short: proteus inventory_hostname_short: proteus
common_iptables_v4: "iptables_proteus_v4.j2"

2
host_vars/zyklon
View File

@@ -1,2 +1,4 @@
inventory_hostname: zyklon.fet.htu.tuwien.ac.at inventory_hostname: zyklon.fet.htu.tuwien.ac.at
inventory_hostname_short: zyklon inventory_hostname_short: zyklon
common_iptables_v4: "iptables_zyklon_v4.j2"

2
roles/common

Submodule roles/common updated: d738a88a2f...5e916ca510

8
templates/iptables_ariane_v4.j2
View File

@@ -4,14 +4,14 @@
:INPUT DROP [0:0] :INPUT DROP [0:0]
:FORWARD DROP [0:0] :FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0] :OUTPUT ACCEPT [0:0]
-A INPUT -s 192.168.86.0/24 -d 192.168.86.0/24 -p udp -m multiport --dports 10053,111,2049,32769,875,892 -m state --state NEW,ESTABLISHED -j ACCEPT
-A INPUT -s 192.168.86.0/24 -d 192.168.86.0/24 -p tcp -m multiport --dports 10053,111,2049,32803,875,892 -m state --state NEW,ESTABLISHED -j ACCEPT
-A OUTPUT -s 192.168.86.0/24 -d 192.168.86.0/24 -p udp -m multiport --sports 10053,111,2049,32769,875,892 -m state --state ESTABLISHED -j ACCEPT
-A OUTPUT -s 192.168.86.0/24 -d 192.168.86.0/24 -p tcp -m multiport --sports 10053,111,2049,32803,875,892 -m state --state ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT -A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -p icmp -j ACCEPT -A INPUT -p icmp -j ACCEPT
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i lo -j ACCEPT -A INPUT -i lo -j ACCEPT
-A INPUT -s 192.168.86.0/24 -d 192.168.86.0/24 -p udp -m multiport --dports 10053,111,2049,32769,875,892 -m state --state NEW,ESTABLISHED -j ACCEPT
-A INPUT -s 192.168.86.0/24 -d 192.168.86.0/24 -p tcp -m multiport --dports 10053,111,2049,32803,875,892 -m state --state NEW,ESTABLISHED -j ACCEPT
-A OUTPUT -s 192.168.86.0/24 -d 192.168.86.0/24 -p udp -m multiport --sports 10053,111,2049,32769,875,892 -m state --state ESTABLISHED -j ACCEPT
-A OUTPUT -s 192.168.86.0/24 -d 192.168.86.0/24 -p tcp -m multiport --sports 10053,111,2049,32803,875,892 -m state --state ESTABLISHED -j ACCEPT
-A INPUT -p tcp -j REJECT --reject-with tcp-reset -A INPUT -p tcp -j REJECT --reject-with tcp-reset
-A INPUT -p udp -j REJECT --reject-with icmp-port-unreachable -A INPUT -p udp -j REJECT --reject-with icmp-port-unreachable
-A INPUT -j REJECT --reject-with icmp-proto-unreachable -A INPUT -j REJECT --reject-with icmp-proto-unreachable

12
templates/iptables_ariane_v6.j2
View File

@@ -1,12 +0,0 @@
# {{ ansible_managed }}
*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -p tcp --syn -j DROP
-A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
-A INPUT -p ipv6-icmp -j ACCEPT
-A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
-A INPUT -i lo -j ACCEPT
COMMIT

12
templates/iptables_progress_v6.j2
View File

@@ -1,12 +0,0 @@
# {{ ansible_managed }}
*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -p tcp --syn -j DROP
-A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
-A INPUT -p ipv6-icmp -j ACCEPT
-A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
-A INPUT -i lo -j ACCEPT
COMMIT

1
templates/iptables_sputnik_v4.j2 → templates/iptables_proteus_v4.j2
View File

@@ -8,6 +8,7 @@
-A INPUT -p icmp -j ACCEPT -A INPUT -p icmp -j ACCEPT
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i lo -j ACCEPT -A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -p tcp -j REJECT --reject-with tcp-reset -A INPUT -p tcp -j REJECT --reject-with tcp-reset
-A INPUT -p udp -j REJECT --reject-with icmp-port-unreachable -A INPUT -p udp -j REJECT --reject-with icmp-port-unreachable
-A INPUT -j REJECT --reject-with icmp-proto-unreachable -A INPUT -j REJECT --reject-with icmp-proto-unreachable

12
templates/iptables_sputnik_v6.j2
View File

@@ -1,12 +0,0 @@
# {{ ansible_managed }}
*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -p tcp --syn -j DROP
-A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
-A INPUT -p ipv6-icmp -j ACCEPT
-A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
-A INPUT -i lo -j ACCEPT
COMMIT

15
templates/iptables_zyklon_v4.j2 Normal file
View File

@@ -0,0 +1,15 @@
# {{ ansible_managed }}
*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m tcp --dport 3000 -j ACCEPT
-A INPUT -p tcp -j REJECT --reject-with tcp-reset
-A INPUT -p udp -j REJECT --reject-with icmp-port-unreachable
-A INPUT -j REJECT --reject-with icmp-proto-unreachable
COMMIT